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-- The MAILING DATE of this communication appears on the cover sheet with the correspondence address -- 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time maybe available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )[3 Responsive to communication(s) filed on 29 September 2003 . 
2a)D This action is FINAL. 2b)S This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) M Claim(s) 1-160 is/are pending in the application. 

4a) Of the above claim(s) 1-127 is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) I3 Claim(s) 128-160 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) 13 The drawing(s) filed on 21 June 2001 is/are: a)M accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 
Priority under 35 U.S.C. §§119 and 120 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
aO All b)D Some*c)D None of: 

Certified copies of the priority documents have been received. 
Certified copies of the priority documents have been received in Application No. . 



10 
2D 
3D 



Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

13) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 119(e) (to a provisional application) 

since a specific reference was included in the first sentence of the specification or in an Application Data Sheet. 
37 CFR 1.78. 

a) □ The translation of the foreign language provisional application has been received. 

14) K Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121 since a specific 

reference was included in the first sentence of the specification or in an Application Data Sheet. 37 CFR 1.78. 
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1) S Notice of References Cited (PTO-892) 

2) IZI Notice of Draftsperson's Patent Drawing Review (PTO-948) 

3) ^ Information Disclosure Statement(s) (PTO-1449) Paper No(s) 6-7 and 1 1 . 



4) CD interview Summary (PTO-413) Paper No(s). 

5) E3 Notice of Informal Patent Application (PTO-1 52) 
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DETAILED ACTION 



Claim Rejections - 35 USC §112 

1 . The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

2. Claims 129, 132, 142, and 156 rejected under 35 U.S.C. 112, second paragraph, 
as being indefinite for failing to particularly point out and distinctly claim the subject 
matter which applicant regards as the invention. 

3. Claim 129 recites the limitation "the notification information" in last line of claim. 
There is insufficient antecedent basis for this limitation in the claim. 

4. Claim 132 recites the limitation "the second notification information" in last line of 
claim. There is insufficient antecedent basis for this limitation in the claim. 

5. Claim 142 recites the limitation "the notification information" in last line of claim. 
There is insufficient antecedent basis for this limitation in the claim. 

6. Claim 147 recites the limitation "the second notification information" in last line of 
claim. There is insufficient antecedent basis for this limitation in the claim. 

7. Claim 147 recites the limitation "the user" in line 4 of claim. There is insufficient 
antecedent basis for this limitation in the claim. 

8. Claim 148 recites the limitation "the user" in last line of claim. There is 
insufficient antecedent basis for this limitation in the claim. 

9. Claim 149 recites the limitation "the user" in second line of claim. There is 
insufficient antecedent basis for this limitation in the claim. 
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10. Claim 150 recites the limitation "the user" in second line of claim. There is 
insufficient antecedent basis for this limitation in the claim. 

1 1 . Claim 1 53 recites the limitation "same packet" in last line of claim. There is 
insufficient antecedent basis for this limitation in the claim. 



Double Patenting 

12. The nonstatutory double patenting rejection is based on a judicially created 
doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the 
unjustified or improper timewise extension of the "right to exclude" granted by a patent 
and to prevent possible harassment by multiple assignees. See In re Goodman, 1 1 
F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 

USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 
1982); In re Vogel, All F.2d 438, 164 USPQ 619 (CCPA 1970);and, In re Thorington, 
418 F.2d 528, 163 USPQ 644 (CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1 .321(c) may be 
used to overcome an actual or provisional rejection based on a nonstatutory double 
patenting ground provided the conflicting application or patent is shown to be commonly 
owned with this application. See 37 CFR 1 .130(b). 

Effective January 1 , 1994, a registered attorney or agent of record may sign a 
terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply with 
37 CFR 3.73(b). 

13. Claims 128-130, 132, 142-143, 145, 147 and 158 are rejected under the judicially 
created doctrine of obviousness-type double patenting as being unpatentable over claim 
17 of U.S. Patent No. 6,339,830 in view of Alexander et al, US Patent 6,212,191 . 

As per claim 128, the Patent teaches the limitations of a user 
authentication method for a communication network having a plurality of nodes, 
the method comprising: entering on a first node first user identification 
information; transmitting to an authentication agent on a second node 



communicating with the first node over a LAN link the first user identification 
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information; relaying from the authentication agent to an authentication server the 
first user identification information; comparing on the authentication server the 
first user identification information with user identification information in a 
database of user identification information; and transmitting from the 
authentication server to the authentication agent, if the first user identification 
information matches user identification information in the database of user 
identification information, information notifying the authentication agent that a 
user on the first node has been authenticated whereupon the authentication 
agent authorizes transmission on the second node of packets in data flows 
involving the first node (claim 17, col 13 In 66-67 and col 14 In 1-20). 

The Patent does not teach a MAC-based authentication flow between an 
authentication client on the first node and the authentication agent. Alexander et 
al discloses a MAC data flow (layer 2 protocol... Medium Access Connection, col 
1 In 1 9-66). One of ordinary skill in the art at the time of the applicant's invention 
would have been able to modify the authentication data flow to include a MAC 
data flow between the client and agent. It would have been obvious to one of 
ordinary skill in the art at the time of the applicant's invention to combine the 
teachings of Alexander et al within the claims of the Patent so that the 
authentication flow can be used with applications residing on a layer 2 protocol 
such as MAC. 



Application/Control Number: 09/886,930 Page 5 

Art Unit: 2131 

As per claim 129, the combination of the Patent and Alexander et al 
teaches the stated limitations as described above. The Patent does not state the 
limitation of relaying from the authentication agent to the authentication client. 
Alexander et al discloses relaying notification information to from an 
authentication server to an authentication client (LE_JOIN_RESPONSE, col 2 In 
26-60). One of ordinary skill in the art would have been able to modify the 
communication network to further relay notification information to the client. It 
would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to combine the teachings of Alexander et al within the 
limitations of the Patent because it would have improved security of the system 
by providing further information to the client. 

As per claim 130 and 145, the combination of the Patent and Alexander et 
al teaches the stated limitations as described above. The Patent does not further 
claim the limitation of transmitting a request to establish an authentication 
session prior to transmitting the first user identification information. The office 
takes official notice that transmitting a request to establish an authentication 
session is well known in the art. One of ordinary skill in the art at the time of the 
applicant's invention would have been able to modify the communication network 
to have the client initiate an authentication session. It would have been obvious 
to one of ordinary skill in the art at the time of the applicant's invention for the 
client to first transmit a request to establish an authentication session because it 
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would have improved security by allowing the client to protect his identification 
information. 

As per claim 132 and 147, the Patent does state the limitation of second 
notification information. Alexander et al discloses sending the client a response 
notifying the status of the authentication. One of ordinary skill in the art at the 
time of the applicant's invention would have realized a modification of sending a 
response back to the client on the status of the authentication procedure. It 
would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to combine the teachings of Alexander et al within the 
combination of the Patent because it would have increased convenience by 
providing clients with the status of their authentication. 

As per claim 142, the limitations of a user authentication method for a 
communication network having a plurality of nodes, the method comprising: 
entering on a first node first user identification information; transmitting to an 
authentication agent on a second node communicating with the first node over a 
LAN link the first user identification information; relaying from the authentication 
agent to an authentication server the first user identification information; 
comparing on the authentication server the first user identification information 
with user identification information in a database of user identification 
information; and transmitting from the authentication server to the authentication 
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agent, if the first user identification information matches user identification 
information in the database of user identification information, information notifying 
the authentication agent that a user on the first node has been authenticated 
whereupon the authentication agent authorizes transmission on the second node 
of packets in data flows involving the first node are taught in the Patent (claim 17, 
col 13 In 66-67 and col 14 In 1-20). 

Furthermore, the limitation of the agent authorizing transmission on the 
second node of packets in data flows involving one or more nodes reachable by 
the first node via the second node is taught in claim 1 of Patent (communicability 
between the first node and a group of nodes). 

The Patent does not claim the limitation of relaying to the first node the 
notification information. Alexander etal discloses relaying notification information 
to and from an authentication server to an authentication client 
(LE_JOINJRESPONSE, col 2 In 26-60). One of ordinary skill in the art would 
have been able to modify the communication network to further relay notification 
information to the client as part of a data flow. It would have been obvious to one 
of ordinary skill in the art at the time of the applicant's invention to combine the 
teachings of Alexander et al within the Patent because it would have improved 
security of the system by providing further information to the client. 

As per claim 143, the limitation of the second node inhibiting transmission 
to any nodes reachable by the first node via the second node of all packets 
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received from the first node that are not part of an authentication flow are claimed 
in claim 32 (second node denies first node access). 

As per claim 158, the Patent does not claim a MAC-based authentication 
flow between an authentication client on the first node and the authentication 
agent. Alexander et al discloses a MAC data flow (layer 2 protocol... Medium 
Access Connection, col 1 In 19-66). One of ordinary skill in the art at the time of 
the applicant's invention would have been able to modify the authentication data 
flow to include a MAC data flow between the client and agent. It would have 
been obvious to one of ordinary skill in the art at the time of the applicant's 
invention to combine the teachings of Alexander et al within the limitations of the 
Patent because it would have added to the flexibility of using existing 
applications. Applications running on a layer 2 protocol such as a MAC are well 
known in the art. 

14. Claims 133, and 148-150 are rejected under the judicially created doctrine of 
obviousness-type double patenting as being unpatentable over claim 17 of U.S. Patent 
No. 6,339,830 in view of Alexander et al, US Patent 6,212,191 and in further view of US 
Patent 6,070,243. 

As per claim 133 and 148-150, claim 17 of US Patent 6,070,243 teaches 
the limitation of determining that the user has made a predetermined number of 
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failed authentication attempts. One of ordinary skill in the art at the time of the 
applicant's invention would have been able to modify the Patent to further inhibit 
authentication attempts after a predetermined number of failed authentication 
attempts as part of the authentication flow. It would have been obvious to one of 
ordinary skill in the art to the combine the limitations of US Patent 6,070,243 
within the Patent because it would have heightened security by preventing 
unwanted clients from authenticating themselves through trial and error. 

Furthermore, the limitation of transmitting information notifying the 
authentication client that further authentication attempts will be inhibited is not 
taught by the Patent. Alexander et al discloses sending the client a response 
notifying the status of the authentication. One of ordinary skill in the art at the 
time of the applicant's invention would have realized a modification of sending a 
response back to the client on the status of the authentication procedure. It 
would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to combine the teachings of Alexander et al within the 
combination of the Patent and US Patent 6,070,243 because it would have 
increased convenience by providing clients with the status of their authentication. 

15. Claims 131 and 146 are rejected under the judicially created doctrine of 
obviousness-type double patenting as being unpatentable over claim 17 of U.S. Patent 
No. 6,339,830 in view of Alexander et al, US Patent 6,212,191, and further in view of 
Wu et al, US Patent 5,774,551 
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As per claim 131 and 146, claim 20 of the Patent does not claim the 
limitation of a logoff request. Wu et al discloses a logoff request from a client (col 
19 In 57-67 and col 20 In 1-8) One of ordinary skill in the art at the time of the 
applicant's invention would have been able to add a logoff request as part of 
communication in the network. It would have been obvious to one of ordinary 
skill in the art at the time of the applicant's invention to combine the teachings of 
Wu et al within the Patent because it would have heightened security by allowing 
a client to logoff the communication network so that no unwanted data are able to 
be transferred. 

16. Claim 134 is rejected under the judicially created doctrine of obviousness-type 
double patenting as being unpatentable over claim 17 of U.S. Patent No. 6,339,830 in 
view of Alexander etal, US Patent 6,212,191 and in further view of Wu etal, US Patent 
5,774,551. 

As per claim 134, the combination of the Patent and Alexander et al 
teaches an authentication system as described above. However, the 
combination of the Patent and Alexander et al does not teach the packets 
transmitted pursuant to the authorization are neither encrypted nor decrypted by 
the second node. Wu discloses packets being transmitted are neither encrypted 
nor decrypted by the second node after the user is authenticated (abstract and 
col 1 9 In 45-56). One of ordinary skill in the art at the time of the applicant's 
inventions would have been able not to encrypt nor decrypt the packets in a 
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communication system after the user is authenticated. It would have been 
obvious to one of ordinary skill in the art at the time of the applicant's invention to 
combine the teachings of Wu et al within the combination of the Patent and 
Alexander et al because it would have simplified the communications on the 
network through less processing of the unencrypted data. 

17. Claims 135-137, 139-141, 151-152,154-157 and 159-160 are rejected under the 
judicially created doctrine of obviousness-type double patenting as being unpatentable 
over claim 17 of U.S. Patent No. 6,339,830. Although the conflicting claims are not 
identical, they are not patentably distinct from each other because: 

As per claim 135, claim limitations of a user authentication method for a 
communication network having a plurality of nodes, the method comprising: 
entering on a first node first user identification information; transmitting to an 
authentication agent on a second node communicating with the first node over a 
LAN link the first user identification information; relaying from the authentication 
agent to an authentication server the first user identification information; 
comparing on the authentication server the first user identification information 
with user identification information in a database of user identification 
information; and transmitting from the authentication server to the authentication 
agent, if the first user identification information matches user identification 
information in the database of user identification information, information notifying 
the authentication agent that a user on the first node has been authenticated 
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whereupon the authentication agent authorizes transmission on the second node 
of packets in data flows involving the first node are taught in.the Patent (claim 17, 
col 13 In 66-67 and col 14 In 1-20). 

Furthermore, the limitation of authorizing an interface to the LAN link to 
allow packets in data flows is taught in Patent (claim 24, col 14 In 58-65). 

As per claim 136, the limitations are stated in claim 24 of Patent. 

As per claim 137, the limitations are stated in claim 3 of Patent. 

As per claim 139, the limitations are stated in claim 20. 

As per claim 140, the limitation second node drops all packets received 
from the first node that are not part of an authentication flow is stated in claim 32 
of Patent (second node denies the first node access). 

As per claim 141 , the limitation the second node drops all packets 
received from the first node that are not addressed to the authentication agent is 
stated in claim 32 of Patent (second node denies the first node access). 

As per claim 1 51 , the limitations of a user authentication method for a 
communication network having a plurality of nodes, the method comprising: 
entering on a first node first user identification information; transmitting to an 
authentication agent on a second node communicating with the first node over a 
LAN link the first user identification information; relaying from the authentication 
agent to an authentication server the first user identification information; 



Application/Control Number: 09/886,930 Page 13 

Art Unit: 2131 

comparing on the authentication server the first user identification information 
with user identification information in a database of user identification 
information; and transmitting from the authentication server to the authentication 
agent, if the first user identification information matches user identification 
information in the database of user identification information, information notifying 
the authentication agent that a user on the first node has been authenticated 
whereupon the authentication agent authorizes transmission on the second node 
of packets in data flows involving the first node are taught in the Patent (claim 17, 
col 13 In 66-67 and col 14 In 1-20). 

Furthermore, the limitation of the packets that are transmitted pursuant to 
the authorization bypass the authentication agent is state in claim 28 of the 
Patent (switching link for switching packets... flow between the node and the 
backbone network). 

As per claim 152, the limitations of a user authentication method for a 
communication network having a plurality of nodes, the method comprising: 
entering on a first node first user identification information; transmitting to an 
authentication agent on a second node communicating with the first node over a 
LAN link the first user identification information; relaying from the authentication 
agent to an authentication server the first user identification information; 
comparing on the authentication server the first user identification information 
with user identification information in a database of user identification 
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information; and transmitting from the authentication server to the authentication 
agent, if the first user identification information matches user identification 
information in the database of user identification information, information notifying 
the authentication agent that a user on the first node has been authenticated 
whereupon the authentication agent authorizes transmission on the second node 
of packets in data flows involving the first node are taught in the Patent (claim 17, 
col 13 In 66-67 and col 14 In 1-20). The limitation of the authentication agent 
authorizing transmission on the second node of packets in data flows that are 
within the VLAN is stated in claim 40 (nodes share a common VLAN). 

Furthermore, the pertaining application claims transmitting information of a 
VLAN for which the user has been authenticated is taught in the combination of 
Claim 23 of Patent states (transmitting a list of network resources for which the 
user is authorized) and claim 15 (network resources are represented by a virtual 
local area network). 

As per claim 154, the Patent further teaches appending packets 
transmitted pursuant to the authorization and transmitted from the second node 
to a backbone network in claim 32 (second node provides for the sole interface 
between the first node and a LAN backbone). 

As per claim 155, the limitation of claim is stated in claim 40 of Patent. 

As per claim 156, the limitation of claim is stated in claim 32 of Patent. 

As per claim 157, the limitation of claim is stated in claim 40 of Patent. 
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As per claim 159, the limitation of authorizing an interface to the LAN link 
to allow packets in data flows are taught in Patent (claim 24, col 14 In 58-65). 

As per claim 160, the limitation of the packets that are transmitted 
pursuant to the authorization bypass the authentication agent is stated in claim 
28 of the Patent (switching link for switching packets... flow between the node 
and the backbone network). 

1 8. Claims 1 38 is rejected under the judicially created doctrine of obviousness-type 
double patenting as being unpatentable over claim 17 of U.S. Patent No. 6,339,830 in 
view of Willens, US Patent 5,889,958. 

As per claim 138, the Patent does not further teach the authentication 
server being a RADIUS server. Willens discloses the use of a RADIUS server for 
authentication of clients in a communications network (abstract). It would have 
been obvious to one of ordinary skill in the art at the time of the applicant's 
invention to combine the teachings of Willens within the system of the Patent 
because it would have improved efficiency by allowing the system to adopt a 
policy that can be applied at a single administered network point. 

1 9. Claim 1 44 is rejected under the judicially created doctrine of obviousness-type 
double patenting as being unpatentable over claim 17 of U.S. Patent No. 6,339,830 in 
view of Alexander et al, US Patent 6,212,191 , and further in view of Zenchelsky et al, 
US Patent 6,233,686. 
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As per claim 144, the limitation of the second node inhibiting transmission 
to any nodes reachable by the first node via the second node of all packets 
received from the first node claimed in claim 32 (second node denies first node 
access). Zenchelsky et al discloses an authentication system that drops packets 
depending on their source and destination address (col 2 In 42-51). One of 
ordinary skill in the art at the time of the applicant's invention would have realized 
the use of the filter in Zenchelsky et al's teachings for filtering packets in a 
communications network. It would have been obvious to one of ordinary skill in 
the art at the time of the applicant's invention to combine the teachings of 
Zenchelsky et al within the claims of the Patent because it would have created 
more bandwidth in the network by dropping unnecessary packets. 

20. Claim 1 53 is rejected under the judicially created doctrine of obviousness-type 
double patenting as being unpatentable over claim 17 of U.S. Patent No. 6,339,830 in 
view of Alexander et al US Patent 6,21 2,1 91 . 

As per claim 153, the Patent discloses information notifying the 
authentication agent that the user on the first node has been authenticated in 
claim 17 of Patent, and information identifying a VLAN in claim 13 of Patent 
(virtual local area network identifier) and transmitting information from the 
authentication server to the authentication agent in claim 17 of Patent. However, 
the Patent does not teach transmitting information in the same packet. 
Alexander et al discloses sending information on the status of the authentication 




• 
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and information on the identification information of the network in one packet 
(LE_CONFIGURE_RESPONSE indicates a success and a Target ATM Address, 
col 5 In 42-65). A VLAN identifier identifies the network of the node. The ATM 
address also identifies the location of a node on a network. One of ordinary skill 
in the art at the time of the applicant's invention would have realized that a VLAN 
identifier can be substituted for the ATM address in the response packet of 
Alexander et al's disclosure. It would have been obvious to one of ordinary skill 
in the art at the time of the applicant's invention to combine the teachings of 
Alexander et al within the claims of the Patent because it would have decreased 
the amount of communication between the server and agent and therefore 
relieve the bandwidth in the network. 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Allen S. Wu whose telephone number is 703-305-0708. 
The examiner can normally be reached on Monday-Friday 9am-5pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Vu can be reached on 703-305-4393. The fax phone number for the 
organization where this application or proceeding is assigned is N/A. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is 703-305- 
0900. 



Conclusion 
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